GHSA-36fq-jgmw-4r9c

Suggest an improvement
Source
https://github.com/advisories/GHSA-36fq-jgmw-4r9c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-36fq-jgmw-4r9c/GHSA-36fq-jgmw-4r9c.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-36fq-jgmw-4r9c
Aliases
  • CVE-2025-9906
Published
2025-09-19T09:31:14Z
Modified
2025-09-19T17:44:33.301772Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Keras is vulnerable to Deserialization of Untrusted Data
Details

The Keras Model.loadmodel method can be exploited to achieve arbitrary code execution, even with safemode=True.

One can create a specially crafted .keras model archive that, when loaded via Model.loadmodel, will trigger arbitrary code to be executed. This is achieved by crafting a special config.json (a file within the .keras archive) that will invoke keras.config.enableunsafedeserialization() to disable safe mode. Once safe mode is disable, one can use the Lambda layer feature of keras, which allows arbitrary Python code in the form of pickled code. Both can appear in the same archive. Simply the keras.config.enableunsafe_deserialization() needs to appear first in the archive and the Lambda with arbitrary code needs to be second.

Database specific 
{
    "nvd_published_at": "2025-09-19T09:15:36Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-502"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-19T17:16:44Z"
}
References

Affected packages

PyPI / keras

Package

Name
keras
View open source insights on deps.dev
Purl
pkg:pypi/keras

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.11.0

Affected versions

0.*

0.2.0
0.3.0
0.3.1
0.3.2
0.3.3

1.*

1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.0.8
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2

2.*

2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.3.0
2.3.1
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0rc0
2.6.0rc0
2.6.0rc1
2.6.0rc2
2.6.0rc3
2.6.0
2.7.0rc0
2.7.0rc2
2.7.0
2.8.0rc0
2.8.0rc1
2.8.0
2.9.0rc0
2.9.0rc1
2.9.0rc2
2.9.0
2.10.0rc0
2.10.0rc1
2.10.0
2.11.0rc0
2.11.0rc1
2.11.0rc2
2.11.0rc3
2.11.0
2.12.0rc0
2.12.0rc1
2.12.0
2.13.1rc0
2.13.1rc1
2.13.1
2.14.0rc0
2.14.0
2.15.0rc0
2.15.0rc1
2.15.0

3.*

3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.8.0
3.9.0
3.9.1
3.9.2
3.10.0